[Proposal] Lower the ACS-Core floor: conditional MODIFY, liveness, Wrapped MCP, and subagentStart

[rocklambros]

The problem

ACS-Core requires MODIFY support, system/ping, and Wrapped MCP from every deployment. A framework that cannot rewrite its own outbound payload, or a deployment that never touches MCP, falls outside conformance for reasons unrelated to the property ACS protects. Meanwhile subagentStart, the gate against a spawned agent inheriting authority it was never granted, sits at SHOULD.

Why the wire has to carry it

Nothing new goes on the wire. The change is requirement levels in docs/spec/conformance.md and the sections it cites, a new §6.5 for clients that cannot apply MODIFY, and dropping final_chain_hash from subagent-stop.json's required list so a framework with no session chain can emit the event without fabricating a hash.

Which constituencies this affects

• Observed Agent implementers
• Guardian implementers
• Policy authors
• Auditors and incident responders
• Platform and harness vendors
• Enterprise deployers

Alternatives considered

Leave the floor as it stands and let adapters describe partial conformance in prose, which puts the honesty burden on documentation nobody validates. Or split Core into a smaller floor plus a profile, which gives ACS two baselines to explain.

Discussion link

No Discussion exists. PR #21 and its review thread carry the argument.

Current Priority Scope

Feeds conformance evidence

[rocklambros]

Adding the subagentStart floor question to this issue rather than opening a separate one, since PR #21 is already the place where the floor is being set and splitting it would put two halves of one decision in two threads.

The argument for subagentStart at MUST is the one already in the issue body, and it holds: it is the gate against a spawned agent inheriting authority it was never granted, and without it a Guardian is blind to the confused-deputy class. The conditional framing in #21 is the right shape, because a client whose framework has no sub-agent abstraction has nothing to emit and should not be pushed outside conformance for it.

The part worth deciding here rather than later is the asymmetry the PR leaves behind. #21 sets subagentStart as a conditional MUST and restates subagentStop as SHOULD-emit, audit-only, not decision-eligible. That gives the spawn path a gate and the return path a notification.

summary.value on subagentStop re-enters the parent's working context and the parent acts on it. post-compact.json faces the same shape, content generated by a finished process crossing into a context another process will act on, and resolves it the other way: MAY return modify, MUST NOT return deny, because the work is done but the content still has to be governable. Both hooks define summary with required: ["value", "provenance"], so they are not merely analogous, they are built the same way.

Not asking to widen #21. The floor decision should land as scoped. Two options, and the second is probably right:

1. Fold a subagentStop eligibility change into Set the ACS-Core floor: MODIFY and system/ping to SHOULD, Wrapped MCP and subagentStart as conditional MUSTs #21, which grows a P0 PR that is already blocked on review.
2. Land Set the ACS-Core floor: MODIFY and system/ping to SHOULD, Wrapped MCP and subagentStart as conditional MUSTs #21 as written, then reconsider subagentStop against the merged text.

I have a draft issue for the second path and am holding it rather than filing against a line #21 is actively rewriting. Say the word if it is more useful open now.

[rocklambros]

Update on the draft mentioned above: filed as #146, and the argument changed while checking it against #21.

The defect turned out to be narrower and more objective than "should subagentStop be gated." hooks.md uses "Not decision-eligible" for postCompact and permits MODIFY in the same sentence, and uses it again for turnEnd where nothing is permitted. subagentStop is then labelled "Not decision-eligible" in its schema and "Audit only" in hooks.md, which the postCompact precedent says are different statements.

So #146 asks which was intended for subagentStop rather than asserting an answer, and it is written against the tree as #21 leaves it. #21 does not touch the sentence in question, so nothing there needs reworking after the merge.